What happened
In mid-2024 the furniture and homewares retailer Early Settler confirmed a data breach exposing customer contact information — names, emails, phone numbers and delivery addresses, and some dates of birth [es-cd], [es-ib], [es-company]. The company said the data came from an archived database dating to July 2022, and that no payment-card data was stored or exposed [es-cd]. It said it was notifying the OAIC and ACSC in Australia, and New Zealand’s Privacy Commissioner and CERT NZ [es-cd], [es-ib].
Timeline
- 2024-07 — An attacker claimed to have published the data; the company did not give an intrusion date, so the breach date is recorded only as 2024 [es-cd].
- 2024-08 — Early Settler confirmed the breach publicly [es-cd], [es-company].
Current status
Disclosed. The attacker claimed roughly 1.1 million records; the company did not confirm a figure, so no count is asserted here [es-cd].
Why it matters
Even a contact-details breach at a retailer feeds targeted phishing, and this one crossed the Tasman — Australian and New Zealand customers alike.